Skip to content

Add Regular Expression limits - #4315

Open
rvesse wants to merge 5 commits into
apache:mainfrom
rvesse:regex-limits
Open

rvesse wants to merge 5 commits into
apache:mainfrom
rvesse:regex-limits

Conversation

@rvesse

@rvesse rvesse commented Oct 8, 2026 •

Copy link
Copy Markdown
Member

Various SPARQL functions and Jena provided extension functions provide access to regular expressions. Depending on the expression and data combination some regular expressions can take too long to run leading to slow queries. This PR bounds regular expression evaluation time via statically controlled limits so regular expressions that take too long to run are aborted with an ExprEvalException.

As ShEx also uses the same Jena subsystem it was also upgraded to apply limits.


  • Tests are included.
  • Documentation change and updates are provided for the Apache Jena website
  • Commits have been squashed to remove intermediate development commit messages.
  • Key commit messages start with the issue number (GH-xxxx)

By submitting this pull request, I acknowledge that I am making a contribution to the Apache Software Foundation under the terms and conditions of the Contributor's Agreement.


See the Apache Jena "Contributing" guide.

When given a poorly formed regular expression depending on data the
regular expression matching can take a long time to compute.  This
commit modifies the expression engine so that regular expression based
functions time bound evaluation to avoid runaway expressions.
Ensures that the ARQ property function strSplit time bounds regular
expression splitting time
REPLACE uses regular expressions to perform replacements so also impose
regular expression limits on its evaluation
Shex regular expression constraints could run too long depending on the
regular expression and data combinations.  This commit uses the shared
RegexEngine.timeBounded() mechanism to limit evaluation time.

Also disables a test scenario where optimisation effects means that the
test does not reliably fail so is not a useful stable test.
Adds new SparqlLimits, which replaces previously introduced MathLimits,
as a central location for configuring relevant limit controls and
generic enforcement functions.

Also simplifies some test case names as requested
@rvesse

rvesse commented Nov 9, 2026

Copy link
Copy Markdown
Member Author

@afs I've consolidated the various limit controls from this and related PRs into a new SparqlLimits class, also have renamed some of the test cases to more straightforward names as requested

@rvesse
rvesse requested a review from afs November 9, 2026 10:54
@rvesse
rvesse marked this pull request as ready for review November 10, 2026 09:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants